Guidance on how to authenticate to private ECR

[rizolo]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

CLI via Github Action

Please tell us more about your question or problem

I'm trying to set up Renovate, currently using local CLI calls but eventually to be used via a Github workflow using the CLI, in order to authenticate and then upgrade my container images on a terraform file using a custom RegEx manager. However, Renovate seems to fail when attempting to authenticate.

I was using the docs in order to figure out how to authenticate with ECR, and am able to locally pull my image as I want, but I cannot seem to figure out how to authenticate the repository with Renovate.

Any guidance would be helpful!

Current config:

"hostRules": [
    {
      "hostType": "ecr",
      "matchHost": "https://123456.dkr.ecr.us-east-1.amazonaws.com",
      "username": "AWS",
      "encrypted": {
        "password": "{{process.env.AWS_ECR_PASSWORD}}"
      }
    }
  ],
  "customManagers": [
    { 
      "customType": "regex",
      "fileMatch": [ "something.tf" ],  
      "matchStrings": [ "ecs_container_image.*= \"123456\\.dkr\\.ecr\\.us-east-1\\.amazonaws\\.com\/(?<packageName>.*):(?<currentValue>.*)\"" ],
      "datasourceTemplate": "docker"
    }
  ],
  "packageRules": [
    {
      "matchDatasources": ["docker"],
      "registryUrls": ["https://123456.dkr.ecr.us-east-1.amazonaws.com"]
    }

How I'm running the CLI locally (at the moment)

docker run -ti --platform=linux/amd64 --rm -v $(pwd):/usr/src/app -e LOG_LEVEL=debug -e RENOVATE_CONFIG_FILE=renovate/renovate.json -e RENOVATE_AWS_ECR_PASSWORD=$(aws ecr get-login-password) -e RENOVATE_GITHUB_COM_TOKEN=$(gh auth token) renovate/renovate --platform=local --onboarding=false 

Logs (if relevant)

Logs

�[34mDEBUG�[39m: getDigest(https://123456.dkr.ecr.us-east-1.amazonaws.com, my/image, main-a1c2c3)�[90m (repository=local)�[39m
�[34mDEBUG�[39m: getManifestResponse(https://123456.dkr.ecr.us-east-1.amazonaws.com, my/image, main-a1c2c3, head)�[90m (repository=local)�[39m
�[34mDEBUG�[39m: Using queue: host=123456.dkr.ecr.us-east-1.amazonaws.com, concurrency=16�[90m (repository=local)�[39m
�[34mDEBUG�[39m: getDigest(https://123456.dkr.ecr.us-east-1.amazonaws.com, my/image, main-a1b2c2)�[90m (repository=local)�[39m
�[34mDEBUG�[39m: getManifestResponse(https://123456.dkr.ecr.us-east-1.amazonaws.com, my/image, head)�[90m (repository=local)�[39m
�[34mDEBUG�[39m: getDigest(https://123456.dkr.ecr.us-east-1.amazonaws.com, my/image, main-a1b2c2)�[90m (repository=local)�[39m
�[34mDEBUG�[39m: getManifestResponse(https://123456.dkr.ecr.us-east-1.amazonaws.com, my/image, head)�[90m (repository=local)�[39m
�[34mDEBUG�[39m: getDigest(https://123456.dkr.ecr.us-east-1.amazonaws.com, my/image, main-a1b2c2)�[90m (repository=local)�[39m
�[34mDEBUG�[39m: getManifestResponse(https://123456.dkr.ecr.us-east-1.amazonaws.com, my/image, head)�[90m (repository=local)�[39m
�[34mDEBUG�[39m: getDigest(https://123456.dkr.ecr.us-east-1.amazonaws.com, my/image, main-a1c2c3)�[90m (repository=local)�[39m
�[34mDEBUG�[39m: getManifestResponse(https://123456.dkr.ecr.us-east-1.amazonaws.com, my/image, head)�[90m (repository=local)�[39m
�[34mDEBUG�[39m: hostRules: ecr auth for https://123456.dkr.ecr.us-east-1.amazonaws.com�[90m (repository=local)�[39m
�[35m WARN�[39m: ECR getAuthorizationToken error�[90m (repository=local)�[39m
�[34mDEBUG�[39m: hostRules: testing direct auth for https://123456.dkr.ecr.us-east-1.amazonaws.com�[90m (repository=local)�[39m
�[35m WARN�[39m: No docker auth found - returning�[90m (repository=local)�[39m
�[35m WARN�[39m: ECR getAuthorizationToken error�[90m (repository=local)�[39m
�[35m WARN�[39m: No docker auth found - returning�[90m (repository=local)�[39m
�[35m WARN�[39m: ECR getAuthorizationToken error�[90m (repository=local)�[39m
�[35m WARN�[39m: No docker auth found - returning�[90m (repository=local)�[39m
�[35m WARN�[39m: ECR getAuthorizationToken error�[90m (repository=local)�[39m
�[35m WARN�[39m: No docker auth found - returning�[90m (repository=local)�[39m
�[35m WARN�[39m: ECR getAuthorizationToken error�[90m (repository=local)�[39m
�[35m WARN�[39m: No docker auth found - returning�[90m (repository=local)�[39m
�[34mDEBUG�[39m: Could not determine new digest for update.�[90m (repository=local)�[39m
       "packageName": "my/image,
       "currentValue": "main-a1b2c3",
       "datasource": "docker",
       "newValue": "main-a1b2c3",
       "bucket": undefined

[RahulGautamSingh]

hostType should be docker

https://docs.renovatebot.com/docker/#aws-ecr-amazon-web-services-elastic-container-registry

[jamietanna]

@rizolo can you please confirm if this has worked for you?

[jaredcdep]

has anyone got this working?